@rangka/core 0.0.1

package/dist/auth/__tests__/integration.test.js

@@ -0,0 +1,186 @@
+import { describe, it, expect } from 'vitest';
+import Fastify from 'fastify';
+import { PermissionRegistry } from '../permission-registry.js';
+import { createAuthHook } from '../session.js';
+import { createModelPermissionGuard } from '../model-permissions.js';
+import { createScopeHook, createScopeWriteGuard } from '../scopes.js';
+import { ScopeRegistry } from '../scope-registry.js';
+import { createFieldWriteGuard, createFieldStripHook } from '../field-permissions.js';
+import { SchemaRegistry } from '../../schema/registry.js';
+import { hashPassword } from '../password.js';
+const invoiceModel = {
+    qualifiedName: 'sales.invoice',
+    app: 'sales',
+    module: 'sales',
+    name: 'invoice',
+    auditLog: false,
+    traits: [],
+    fields: [
+        {
+            name: 'id',
+            config: { type: 'string', required: true },
+            provenance: { source: 'base' },
+        },
+        { name: 'total', config: { type: 'decimal' }, provenance: { source: 'base' } },
+        { name: 'cost_price', config: { type: 'decimal' }, provenance: { source: 'base' } },
+        { name: 'territory', config: { type: 'string' }, provenance: { source: 'base' } },
+    ],
+    indexes: [],
+};
+function createMockDb() {
+    const users = [
+        {
+            id: 'u1',
+            email: 'sales@test.com',
+            full_name: 'Sales User',
+            enabled: true,
+            password_hash: hashPassword('pass'),
+            territories: ['North', 'East'],
+        },
+    ];
+    const roles = [{ id: 'r1', name: 'Sales User' }];
+    const userRoles = [{ user_id: 'u1', role_id: 'r1' }];
+    const sessions = [
+        {
+            id: 's1',
+            token: 'test-token',
+            user_id: 'u1',
+            expires_at: new Date(Date.now() + 60000).toISOString(),
+        },
+    ];
+    return {
+        selectFrom(table) {
+            const store = table === 'core.user'
+                ? users
+                : table === 'core.role'
+                    ? roles
+                    : table === 'core.user_role'
+                        ? userRoles
+                        : table === 'core.session'
+                            ? sessions
+                            : [];
+            return {
+                selectAll() {
+                    return this;
+                },
+                select(..._a) {
+                    return this;
+                },
+                where(field, op, value) {
+                    const filtered = store.filter((r) => {
+                        if (op === '=')
+                            return r[field] === value;
+                        if (op === 'in')
+                            return value.includes(r[field]);
+                        return false;
+                    });
+                    return {
+                        executeTakeFirst: async () => filtered[0],
+                        execute: async () => filtered,
+                        where(f2, o2, v2) {
+                            const f = filtered.filter((r) => {
+                                if (o2 === '=')
+                                    return r[f2] === v2;
+                                if (o2 === 'in')
+                                    return v2.includes(r[f2]);
+                                return false;
+                            });
+                            return { executeTakeFirst: async () => f[0], execute: async () => f };
+                        },
+                    };
+                },
+                executeTakeFirst: async () => undefined,
+                execute: async () => [],
+            };
+        },
+    };
+}
+describe('integration: auth + permissions + scopes + field stripping', () => {
+    it('full pipeline works end-to-end', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            'Sales User': {
+                label: 'Sales User',
+                models: {
+                    'sales.invoice': {
+                        read: true,
+                        write: true,
+                        create: true,
+                        fieldPermissions: {
+                            cost_price: { read: false },
+                        },
+                    },
+                },
+            },
+        }, 'sales');
+        const schemaRegistry = new SchemaRegistry([invoiceModel]);
+        const db = createMockDb();
+        const modules = [];
+        const scopeRegistry = new ScopeRegistry(modules, schemaRegistry);
+        const server = Fastify();
+        const authHook = createAuthHook(db, permissionRegistry);
+        const modelPermHook = createModelPermissionGuard(invoiceModel, permissionRegistry);
+        const scopeCtx = { model: invoiceModel, scopeRegistry, db };
+        const scopeHook = createScopeHook(scopeCtx);
+        const scopeValidationHook = createScopeWriteGuard(scopeCtx);
+        const fieldWriteHook = createFieldWriteGuard(invoiceModel);
+        const fieldStripHook = createFieldStripHook(invoiceModel);
+        server.get('/api/sales/invoice', {
+            onRequest: authHook,
+            preHandler: [modelPermHook, scopeHook, scopeValidationHook, fieldWriteHook],
+            onSend: fieldStripHook,
+            handler: async (request) => {
+                const ctx = request.authContext;
+                return {
+                    data: [{ id: '1', total: 100, cost_price: 50, territory: 'North' }],
+                    scopeFilters: ctx.scopeFilters,
+                };
+            },
+        });
+        // Successful authenticated + authorized request
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/sales/invoice',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        // cost_price should be stripped
+        expect(body.data[0].cost_price).toBeUndefined();
+        expect(body.data[0].total).toBe(100);
+        // scope filters should be present
+        expect(body.scopeFilters).toHaveLength(0);
+    });
+    it('returns 401 without auth', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({ X: { label: 'X', models: {} } }, 'app');
+        const db = createMockDb();
+        const server = Fastify();
+        server.get('/test', {
+            onRequest: createAuthHook(db, permissionRegistry),
+            handler: async () => ({ ok: true }),
+        });
+        const res = await server.inject({ method: 'GET', url: '/test' });
+        expect(res.statusCode).toBe(401);
+    });
+    it('returns 403 without model permission', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            'Sales User': { label: 'Sales User', models: { 'other.model': { read: true } } },
+        }, 'sales');
+        const db = createMockDb();
+        const server = Fastify();
+        server.get('/test', {
+            onRequest: createAuthHook(db, permissionRegistry),
+            preHandler: [createModelPermissionGuard(invoiceModel, permissionRegistry)],
+            handler: async () => ({ ok: true }),
+        });
+        const res = await server.inject({
+            method: 'GET',
+            url: '/test',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(403);
+    });
+});
+//# sourceMappingURL=integration.test.js.map

package/dist/auth/__tests__/integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.js","sourceRoot":"","sources":["../../../src/auth/__tests__/integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,OAAO,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACtF,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9C,MAAM,YAAY,GAAkB;IAClC,aAAa,EAAE,eAAe;IAC9B,GAAG,EAAE,OAAO;IACZ,MAAM,EAAE,OAAO;IACf,IAAI,EAAE,SAAS;IACf,QAAQ,EAAE,KAAK;IACf,MAAM,EAAE,EAAE;IACV,MAAM,EAAE;QACN;YACE,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAS;YACjD,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC/B;QACD,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACrF,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QAC1F,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAS,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;KACzF;IACD,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG;QACZ;YACE,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,gBAAgB;YACvB,SAAS,EAAE,YAAY;YACvB,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,YAAY,CAAC,MAAM,CAAC;YACnC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;SAC/B;KACF,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAG;QACf;YACE,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,YAAY;YACnB,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,WAAW,EAAE;SACvD;KACF,CAAC;IAEF,OAAO;QACL,UAAU,CAAC,KAAa;YACtB,MAAM,KAAK,GACT,KAAK,KAAK,WAAW;gBACnB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,KAAK,KAAK,WAAW;oBACrB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,KAAK,gBAAgB;wBAC1B,CAAC,CAAC,SAAS;wBACX,CAAC,CAAC,KAAK,KAAK,cAAc;4BACxB,CAAC,CAAC,QAAQ;4BACV,CAAC,CAAC,EAAE,CAAC;YAEf,OAAO;gBACL,SAAS;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,CAAC,GAAG,EAAS;oBACjB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,KAAK,CAAC,KAAa,EAAE,EAAU,EAAE,KAAU;oBACzC,MAAM,QAAQ,GAAI,KAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;wBAC7C,IAAI,EAAE,KAAK,GAAG;4BAAE,OAAO,CAAC,CAAC,KAAK,CAAC,KAAK,KAAK,CAAC;wBAC1C,IAAI,EAAE,KAAK,IAAI;4BAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;wBACjD,OAAO,KAAK,CAAC;oBACf,CAAC,CAAC,CAAC;oBACH,OAAO;wBACL,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;wBACzC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;wBAC7B,KAAK,CAAC,EAAU,EAAE,EAAU,EAAE,EAAO;4BACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE;gCACnC,IAAI,EAAE,KAAK,GAAG;oCAAE,OAAO,CAAC,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;gCACpC,IAAI,EAAE,KAAK,IAAI;oCAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gCAC3C,OAAO,KAAK,CAAC;4BACf,CAAC,CAAC,CAAC;4BACH,OAAO,EAAE,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;wBACxE,CAAC;qBACF,CAAC;gBACJ,CAAC;gBACD,gBAAgB,EAAE,KAAK,IAAI,EAAE,CAAC,SAAS;gBACvC,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE;aACxB,CAAC;QACJ,CAAC;KACK,CAAC;AACX,CAAC;AAED,QAAQ,CAAC,4DAA4D,EAAE,GAAG,EAAE;IAC1E,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACpD,kBAAkB,CAAC,aAAa,CAC9B;YACE,YAAY,EAAE;gBACZ,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE;oBACN,eAAe,EAAE;wBACf,IAAI,EAAE,IAAI;wBACV,KAAK,EAAE,IAAI;wBACX,MAAM,EAAE,IAAI;wBACZ,gBAAgB,EAAE;4BAChB,UAAU,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE;yBAC5B;qBACF;iBACF;aACF;SACF,EACD,OAAO,CACR,CAAC;QAEF,MAAM,cAAc,GAAG,IAAI,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;QAE1B,MAAM,OAAO,GAAmB,EAAE,CAAC;QACnC,MAAM,aAAa,GAAG,IAAI,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAEjE,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,EAAE,kBAAkB,CAAC,CAAC;QACxD,MAAM,aAAa,GAAG,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAC5D,MAAM,cAAc,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAC3D,MAAM,cAAc,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;QAE1D,MAAM,CAAC,GAAG,CAAC,oBAAoB,EAAE;YAC/B,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,mBAAmB,EAAE,cAAc,CAAC;YAC3E,MAAM,EAAE,cAAqB;YAC7B,OAAO,EAAE,KAAK,EAAE,OAAY,EAAE,EAAE;gBAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;gBAChC,OAAO;oBACL,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;oBACnE,YAAY,EAAE,GAAG,CAAC,YAAY;iBAC/B,CAAC;YACJ,CAAC;SACF,CAAC,CAAC;QAEH,gDAAgD;QAChD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,oBAAoB;YACzB,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE;SAChD,CAAC,CAAC;QAEH,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,gCAAgC;QAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,kCAAkC;QAClC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACpD,kBAAkB,CAAC,aAAa,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;QAC3E,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;QAE1B,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;YAClB,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,kBAAkB,CAAC;YACjD,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QACpD,MAAM,kBAAkB,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACpD,kBAAkB,CAAC,aAAa,CAC9B;YACE,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SACjF,EACD,OAAO,CACR,CAAC;QAEF,MAAM,EAAE,GAAG,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,EAAE,CAAC;QAEzB,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;YAClB,SAAS,EAAE,cAAc,CAAC,EAAE,EAAE,kBAAkB,CAAC;YACjD,UAAU,EAAE,CAAC,0BAA0B,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;YAC1E,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACpC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC;YAC9B,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,OAAO;YACZ,OAAO,EAAE,EAAE,aAAa,EAAE,mBAAmB,EAAE;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/auth/__tests__/meta-boot.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=meta-boot.test.d.ts.map

package/dist/auth/__tests__/meta-boot.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meta-boot.test.d.ts","sourceRoot":"","sources":["../../../src/auth/__tests__/meta-boot.test.ts"],"names":[],"mappings":""}

package/dist/auth/__tests__/meta-boot.test.js

@@ -0,0 +1,459 @@
+import { describe, it, expect } from 'vitest';
+import { PermissionRegistry } from '../permission-registry.js';
+import { createAuthHook } from '../session.js';
+import { createMetaBootHandler } from '../../api/meta-handler.js';
+import { SchemaRegistry } from '../../schema/registry.js';
+import { hashPassword } from '../password.js';
+import { createTestServer } from '../../__tests__/helpers.js';
+const orderModel = {
+    qualifiedName: 'sales.order',
+    app: 'sales',
+    module: 'sales',
+    name: 'order',
+    label: 'Sales Order',
+    auditLog: false,
+    traits: [],
+    fields: [
+        {
+            name: 'id',
+            config: { type: 'string', required: true },
+            provenance: { source: 'base' },
+        },
+        {
+            name: 'customer',
+            config: { type: 'link', model: 'sales.customer', label: 'Customer' },
+            provenance: { source: 'base' },
+        },
+        {
+            name: 'total',
+            config: { type: 'decimal', label: 'Total' },
+            provenance: { source: 'base' },
+        },
+        {
+            name: 'status',
+            config: { type: 'enum', options: ['draft', 'confirmed'], label: 'Status' },
+            provenance: { source: 'base' },
+        },
+    ],
+    indexes: [],
+};
+const payslipModel = {
+    qualifiedName: 'hr.payslip',
+    app: 'hr',
+    module: 'hr',
+    name: 'payslip',
+    label: 'Payslip',
+    auditLog: false,
+    traits: [],
+    fields: [
+        {
+            name: 'id',
+            config: { type: 'string', required: true },
+            provenance: { source: 'base' },
+        },
+        { name: 'amount', config: { type: 'decimal' }, provenance: { source: 'base' } },
+    ],
+    indexes: [],
+};
+const contactModel = {
+    qualifiedName: 'contacts.contact',
+    app: 'contacts',
+    module: 'contacts',
+    name: 'contact',
+    label: 'Contact',
+    auditLog: false,
+    traits: [],
+    fields: [
+        {
+            name: 'id',
+            config: { type: 'string', required: true },
+            provenance: { source: 'base' },
+        },
+        {
+            name: 'name',
+            config: { type: 'string', label: 'Name' },
+            provenance: { source: 'base' },
+        },
+    ],
+    indexes: [],
+};
+const pages = [
+    {
+        module: 'sales',
+        page: {
+            key: 'sales.orders',
+            label: 'Orders',
+            type: 'collection',
+            path: '/sales/orders',
+            body: [
+                { type: 'data', source: { model: 'sales.order' }, children: [] },
+                { type: 'data', source: { model: 'contacts.contact' }, children: [] },
+            ],
+        },
+    },
+    {
+        module: 'hr',
+        page: {
+            key: 'hr.payroll',
+            label: 'Payroll',
+            type: 'collection',
+            path: '/hr/payroll',
+            body: [{ type: 'data', source: { model: 'hr.payslip' }, children: [] }],
+        },
+    },
+    {
+        module: 'admin',
+        page: {
+            key: 'admin.dashboard',
+            label: 'Admin Dashboard',
+            type: 'dashboard',
+            path: '/admin/dashboard',
+            body: [{ type: 'text', props: { content: 'Dashboard' } }],
+        },
+    },
+];
+const modules = [
+    {
+        name: 'sales',
+        label: 'Sales',
+        icon: 'shopping-cart',
+        order: 1,
+        navigation: [
+            {
+                section: 'Orders',
+                items: [{ page: 'sales.orders', label: 'Orders', icon: 'list' }],
+            },
+        ],
+    },
+    {
+        name: 'hr',
+        label: 'Human Resources',
+        icon: 'users',
+        order: 2,
+        navigation: [
+            {
+                section: 'Payroll',
+                items: [{ page: 'hr.payroll', label: 'Payroll', icon: 'dollar' }],
+            },
+        ],
+    },
+    {
+        name: 'admin',
+        label: 'Administration',
+        icon: 'settings',
+        order: 3,
+        navigation: [
+            {
+                section: 'System',
+                items: [{ page: 'admin.dashboard', label: 'Dashboard', icon: 'dashboard' }],
+            },
+        ],
+    },
+];
+function createMockDb(opts) {
+    const users = [
+        {
+            id: 'u1',
+            email: 'sales@test.com',
+            full_name: 'Sales User',
+            enabled: true,
+            password_hash: hashPassword('pass'),
+        },
+    ];
+    const roles = [{ id: 'r1', name: 'SalesRep' }];
+    const userRoles = [{ user_id: 'u1', role_id: 'r1' }];
+    const sessions = opts?.noSession
+        ? []
+        : [
+            {
+                id: 's1',
+                token: 'test-token',
+                user_id: 'u1',
+                expires_at: opts?.expiredSession
+                    ? new Date(Date.now() - 60000).toISOString()
+                    : new Date(Date.now() + 60000).toISOString(),
+            },
+        ];
+    return {
+        selectFrom(table) {
+            const store = table === 'core.user'
+                ? users
+                : table === 'core.role'
+                    ? roles
+                    : table === 'core.user_role'
+                        ? userRoles
+                        : table === 'core.session'
+                            ? sessions
+                            : [];
+            return {
+                selectAll() {
+                    return this;
+                },
+                where(field, op, value) {
+                    const filtered = store.filter((r) => {
+                        if (op === '=')
+                            return r[field] === value;
+                        if (op === 'in')
+                            return value.includes(r[field]);
+                        return false;
+                    });
+                    return {
+                        executeTakeFirst: async () => filtered[0],
+                        execute: async () => filtered,
+                        where(f2, o2, v2) {
+                            const f = filtered.filter((r) => {
+                                if (o2 === '=')
+                                    return r[f2] === v2;
+                                if (o2 === 'in')
+                                    return v2.includes(r[f2]);
+                                return false;
+                            });
+                            return { executeTakeFirst: async () => f[0], execute: async () => f };
+                        },
+                    };
+                },
+                executeTakeFirst: async () => undefined,
+                execute: async () => [],
+            };
+        },
+    };
+}
+function buildServer(permissionRegistry, db, schemaRegistry) {
+    const server = createTestServer();
+    const metaCtx = {
+        schemaRegistry,
+        pages,
+        modules,
+    };
+    server.get('/api/meta/boot', {
+        onRequest: createAuthHook(db, permissionRegistry),
+        handler: createMetaBootHandler(metaCtx),
+    });
+    return server;
+}
+describe('GET /api/meta/boot', () => {
+    it('returns correct boot response for authenticated user with filtered pages/nav/models', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            SalesRep: {
+                label: 'Sales Rep',
+                models: { 'sales.order': { read: true, create: true } },
+                pages: ['admin.dashboard'],
+            },
+        }, 'sales');
+        const schemaRegistry = new SchemaRegistry([orderModel, payslipModel, contactModel]);
+        const db = createMockDb();
+        const server = buildServer(permissionRegistry, db, schemaRegistry);
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        // User
+        expect(body.user).toEqual({
+            id: 'u1',
+            name: 'Sales User',
+            email: 'sales@test.com',
+            roles: ['SalesRep'],
+        });
+        // Permissions
+        expect(body.permissions.models['sales.order']).toEqual({ read: true, create: true });
+        expect(body.permissions.pages).toContain('admin.dashboard');
+        // Pages: sales.orders (model access), admin.dashboard (explicit pages), NOT hr.payroll
+        const pageKeys = body.pages.map((p) => p.key);
+        expect(pageKeys).toContain('sales.orders');
+        expect(pageKeys).toContain('admin.dashboard');
+        expect(pageKeys).not.toContain('hr.payroll');
+        // Navigation: sales and admin modules, NOT hr
+        const navModules = body.navigation.map((n) => n.module);
+        expect(navModules).toContain('sales');
+        expect(navModules).toContain('admin');
+        expect(navModules).not.toContain('hr');
+        // Models: sales.order and contacts.contact (from overlay), NOT hr.payslip
+        expect(body.models['sales.order']).toBeDefined();
+        expect(body.models['contacts.contact']).toBeDefined();
+        expect(body.models['hr.payslip']).toBeUndefined();
+        // Model metadata shape
+        expect(body.models['sales.order'].qualifiedName).toBe('sales.order');
+        expect(body.models['sales.order'].fields.length).toBe(4);
+        const statusField = body.models['sales.order'].fields.find((f) => f.name === 'status');
+        expect(statusField.type).toBe('enum');
+        expect(statusField.options).toEqual(['draft', 'confirmed']);
+        const customerField = body.models['sales.order'].fields.find((f) => f.name === 'customer');
+        expect(customerField.relationship).toEqual({ type: 'link', model: 'sales.customer' });
+    });
+    it('returns 401 for unauthenticated request', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({ SalesRep: { label: 'Sales Rep', models: {} } }, 'sales');
+        const schemaRegistry = new SchemaRegistry([orderModel]);
+        const db = createMockDb();
+        const server = buildServer(permissionRegistry, db, schemaRegistry);
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+        });
+        expect(res.statusCode).toBe(401);
+        expect(res.json().error.code).toBe('UNAUTHORIZED');
+    });
+    it('user with limited permissions only sees accessible pages and referenced models', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            SalesRep: {
+                label: 'Sales Rep',
+                models: { 'hr.payslip': { read: true } },
+            },
+        }, 'app');
+        const schemaRegistry = new SchemaRegistry([orderModel, payslipModel, contactModel]);
+        const db = createMockDb();
+        const server = buildServer(permissionRegistry, db, schemaRegistry);
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        const pageKeys = body.pages.map((p) => p.key);
+        expect(pageKeys).toContain('hr.payroll');
+        expect(pageKeys).toContain('admin.dashboard');
+        expect(pageKeys).not.toContain('sales.orders');
+        expect(body.models['hr.payslip']).toBeDefined();
+        expect(body.models['sales.order']).toBeUndefined();
+    });
+    it('non-model page accessible via explicit pages permission', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            SalesRep: {
+                label: 'Sales Rep',
+                models: {},
+                pages: ['admin.dashboard'],
+            },
+        }, 'app');
+        const schemaRegistry = new SchemaRegistry([orderModel, payslipModel, contactModel]);
+        const db = createMockDb();
+        const server = buildServer(permissionRegistry, db, schemaRegistry);
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        const pageKeys = body.pages.map((p) => p.key);
+        expect(pageKeys).toContain('admin.dashboard');
+        expect(pageKeys).not.toContain('sales.orders');
+        expect(pageKeys).not.toContain('hr.payroll');
+        // No models referenced since admin.dashboard has no model sources
+        expect(Object.keys(body.models)).toHaveLength(0);
+    });
+    it('empty modules/sections are omitted from navigation', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            SalesRep: {
+                label: 'Sales Rep',
+                models: { 'sales.order': { read: true } },
+            },
+        }, 'app');
+        const schemaRegistry = new SchemaRegistry([orderModel, payslipModel, contactModel]);
+        const db = createMockDb();
+        const server = buildServer(permissionRegistry, db, schemaRegistry);
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        const navModules = body.navigation.map((n) => n.module);
+        expect(navModules).toContain('sales');
+        expect(navModules).toContain('admin');
+        expect(navModules).not.toContain('hr');
+        // Navigation is sorted by order
+        expect(body.navigation[0].module).toBe('sales');
+    });
+    it('includes widget and view metadata in boot response', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            SalesRep: {
+                label: 'Sales Rep',
+                models: { 'sales.order': { read: true } },
+            },
+        }, 'sales');
+        const schemaRegistry = new SchemaRegistry([orderModel]);
+        const db = createMockDb();
+        const server = createTestServer();
+        const widgetDefs = [
+            {
+                name: 'button',
+                label: 'Button',
+                category: 'action',
+                schema: { label: { type: 'string', required: true } },
+                binding: 'none',
+                triggers: ['click'],
+                container: false,
+            },
+            {
+                name: 'input',
+                label: 'Input',
+                category: 'input',
+                schema: {},
+                binding: 'field',
+                triggers: ['change'],
+                container: false,
+            },
+        ];
+        const metaCtx = {
+            schemaRegistry,
+            pages,
+            modules,
+            widgets: widgetDefs,
+        };
+        server.get('/api/meta/boot', {
+            onRequest: createAuthHook(db, permissionRegistry),
+            handler: createMetaBootHandler(metaCtx),
+        });
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        expect(body.widgets).toHaveLength(2);
+        expect(body.widgets[0].name).toBe('button');
+        expect(body.widgets[1].name).toBe('input');
+    });
+    it('returns empty arrays when no widgets are registered', async () => {
+        const permissionRegistry = new PermissionRegistry();
+        permissionRegistry.registerRoles({
+            SalesRep: {
+                label: 'Sales Rep',
+                models: { 'sales.order': { read: true } },
+            },
+        }, 'sales');
+        const schemaRegistry = new SchemaRegistry([orderModel]);
+        const db = createMockDb();
+        const server = createTestServer();
+        const metaCtx = {
+            schemaRegistry,
+            pages,
+            modules,
+            widgets: [],
+        };
+        server.get('/api/meta/boot', {
+            onRequest: createAuthHook(db, permissionRegistry),
+            handler: createMetaBootHandler(metaCtx),
+        });
+        const res = await server.inject({
+            method: 'GET',
+            url: '/api/meta/boot',
+            headers: { authorization: 'Bearer test-token' },
+        });
+        expect(res.statusCode).toBe(200);
+        const body = res.json();
+        expect(body.widgets).toEqual([]);
+    });
+});
+//# sourceMappingURL=meta-boot.test.js.map